Every medical device manufacturer understands that clinical evidence is a regulatory requirement. Fewer think carefully about who actually controls it.
The distinction matters more than most teams realize until a study ends, a CRO relationship changes, or a regulatory submission is due and the data is somewhere else.
Clinical evidence is not just documentation. It is the foundation of every submission, every reimbursement argument, every post-market obligation, and in an increasingly scrutinized regulatory environment, every claim made on behalf of a device. Under EU MDR, manufacturers bear full legal responsibility for that evidence under Annex XIV and the broader post-market surveillance framework. Under FDA regulations, and under ISO 14155:2020's Clause 8 sponsor responsibilities, the sponsor of an investigation holds accountability for data integrity regardless of who conducted the study. The regulator does not look to the CRO. The regulator looks to you.
So the question is not whether you are responsible for your clinical evidence. You are. The question is whether your systems, contracts, and platforms actually reflect that responsibility.
Where ownership breaks down in practice
Ownership is not primarily a legal concept. It is an operational one. A manufacturer can have carefully drafted contract language and still find that accessing their own study data requires third-party coordination, waiting periods, or export fees that were not visible when the agreement was signed. In practice, ownership means being able to access your data when you need it, export it in a usable format, and maintain direct visibility into its integrity while a study is running. When any of those capabilities are unclear or depend on a partner's schedule rather than the manufacturer's own access, the gap between legal ownership and operational ownership becomes real.
The most common place this gap opens is around platform access. Many manufacturers, particularly those running their first study, use an EDC platform that the CRO provides as part of the engagement. The convenience is genuine. The CRO already knows the system, study setup is faster, and the manufacturer does not have to evaluate and procure a platform on top of everything else they are managing pre-market.
The complications tend to surface later. When the study ends, data access may be tied to the service relationship rather than guaranteed independently. When a manufacturer wants to reuse the dataset for a follow-on study or a supplement to an existing regulatory submission, export may not be straightforward. When a query needs resolution before a submission deadline, it goes through the CRO's workflow. These are not necessarily failures on the CRO's part. They are situations that arise when data access terms have not been clearly established upfront.
Pharma-oriented EDC platforms present a related consideration. They were designed for a development model where sponsors routinely delegate data management to CROs, and some of their default assumptions around data access reflect that. Medical device studies operate under a different accountability structure. ISO 14155:2020 places sponsor responsibility for study conduct and data integrity with the manufacturer, and the practical infrastructure a team chooses should support that.
What to look for in your contracts before a study starts
Most data access problems are contract problems. By the time a study is running, the terms are already set. The time to establish data rights is before any agreement is signed, across every party that will touch your study data.
In a CRO agreement, the data-related clauses to scrutinize are not always labeled as such. Look at what happens to data access when the contract ends: does access continue, or does it terminate with the service relationship? Look at export terms: is data exportable in an analysis-ready format, or does retrieval require additional coordination? Look at fees: some agreements include data retrieval charges that only become visible when a manufacturer needs their data back after a study closes. These are negotiable terms, but they require active attention during contract review.
A key question to ask any CRO is whether the manufacturer will have direct access to the EDC platform throughout the study, not just access to reports or data cuts the CRO provides. Direct platform access gives the sponsor the monitoring visibility that ISO 14155:2020 Clause 8 describes as a sponsor responsibility. It also means the manufacturer can review data quality in real time, without routing every question through a CRO intermediary.
Site agreements introduce a different set of considerations. Clinical sites collect source data: the original records from which eCRF data is derived. The manufacturer's right to access source documentation for monitoring and verification purposes should be explicit in the site agreement. Under ISO 14155:2020, the sponsor has defined monitoring responsibilities that require access to source data, and an agreement that does not clearly support those responsibilities creates compliance risk independent of any data export question.
Laboratory agreements matter for studies where central laboratory testing generates data that feeds into the clinical dataset. If the laboratory operates on its own data management infrastructure, the same access and export questions apply. A dataset that is partly in one system and partly in another, with no clear path to a unified export, is a structural problem that compounds at submission time.
EDC vendor agreements deserve equal scrutiny. The key questions are: who holds the data tenancy, what happens to data access if the vendor relationship ends, and whether data can be exported in standard formats such as SAS transport files or CSV without additional fees or configuration work. Vendors who make unconditional data export a standard feature signal a fundamentally different relationship with their customers than those who treat export as a paid service.
What ownership looks like across the study lifecycle
Manufacturers who maintain real control over their clinical evidence share some common practices.
Before a study starts, data rights are established in contracts as described above. Platform selection is confirmed with the manufacturer holding direct account access alongside the CRO. The study opens with the manufacturer able to log in and review data independently, regardless of which partner is conducting the operational work.
During a study, direct access means visibility into data as it is collected. Not summary reports. Not waiting for a data cut. The manufacturer should be able to review live eCRF data, run queries, and identify data quality issues before they become systemic. In multi-site studies especially, early visibility into site performance is the difference between a manageable correction and a late-stage crisis. Our guide to EDC systems for clinical trials covers what to look for in a platform that supports sponsor-side access throughout the study.
After a study closes, clear data rights mean the dataset is available to use without renegotiation. The records from a first pivotal investigation are not a one-time regulatory deliverable. They are a long-term asset. Regulatory bodies across the US and EU are increasing expectations around real-world evidence (RWE) and post-market clinical follow-up (PMCF). A manufacturer with clear, unconditional access to their study data can reuse that dataset for a follow-on indication, support a label expansion, respond to a notified body's request for updated evidence, or feed into a registry. A manufacturer without that clarity must work out access terms each time a new need arises.
Post-market is where the long-term cost of unclear data rights becomes most visible. EU MDR Annex XIV requires a proactive, structured PMCF plan with data that is genuinely collected and evaluated, not recycled from pre-market studies without demonstrating continued safety and performance. That ongoing evidence generation program runs more smoothly when the manufacturer has direct access to prior study data and does not need to coordinate retrieval before each CER update.
The value of data you can actually use
Manufacturers often evaluate clinical data platforms by asking whether they support compliant study execution. That is the right starting question. The longer-term question, and the one fewer teams ask early enough, is what a dataset with clear access rights can do for the business beyond its initial regulatory purpose.
Consider label expansion. A manufacturer who successfully cleared a device for one indication often has a defined pathway to expand that label to adjacent indications or populations not covered in the pivotal study. The foundation of a label expansion submission is the existing clinical dataset. With unconditional access and clean export rights, expansion planning can start from a position of strength. Without them, every step involves working out retrieval with a partner whose involvement in the original study may be long past.
Post-market surveillance data feeds the same dynamic. Under EU MDR, the clinical evaluation report (CER) is a living document that must be updated on a defined schedule, with frequency determined by the device's risk classification. An update requires integrating new post-market clinical data with the existing evidence base. Manufacturers with direct access to their clinical data in a single environment can run those updates as a structured internal process. Manufacturers whose data is distributed across multiple systems from different study periods face a reconciliation problem every time a CER update is due.
Investor due diligence is a third context where data access has direct commercial consequences. Acquirers and strategic investors in medtech evaluate the quality and accessibility of clinical evidence as part of their assessment of a company's regulatory position. Clinical data that is accessible, auditable, and exportable in standard formats presents a different picture than data locked in a vendor relationship the acquirer cannot fully evaluate. As we covered in our piece on the clinical evidence investors actually care about, the evidence that moves investors is evidence that clearly supports real-world decisions. Accessible, well-structured data is part of that picture.
Payer and health technology assessment (HTA) bodies represent a fourth downstream use. Reimbursement decisions in markets with formal HTA processes increasingly require real-world evidence and comparative effectiveness data alongside the clinical trial results that supported regulatory clearance. That additional evidence is easier to generate when pre-market and early post-market data is already accessible and well-structured, rather than requiring extraction and reformatting before a new analysis can begin.
When CRO relationships change
Clinical programs regularly outlast the relationships they were built on. CROs get acquired. Contracts end. A manufacturer running a PMCF program five years after their pivotal study may be working with a completely different set of partners than those who ran the original investigation. How smoothly those transitions go depends significantly on whether data access terms were established clearly at the outset.
When data access rights are explicit and unconditional in the original agreements, a change in CRO relationship is primarily a service transition. The manufacturer retains access to their study data, can export it in a usable format, and can bring it into the next phase of their program without needing to negotiate terms with a departing partner. When those rights were not clearly established, a CRO transition can become a data retrieval exercise at a point when the manufacturer typically has a regulatory obligation driving the timeline.
CRO consolidation has been a consistent feature of the medtech services sector in recent years. Manufacturers who established clear data access terms early in their study programs have generally found that partner transitions are operationally manageable. The data access question tends to become most difficult when it surfaces mid-program without a contractual foundation to stand on.
Working with CROs without ceding control
Outsourcing clinical operations to a CRO is a rational choice for many manufacturers. Running a compliant investigation requires site management experience, regulatory affairs expertise, clinical monitoring capacity, and biostatistical support. For lean teams building a first device, that expertise is not always available in-house.
The goal is not to stop working with CROs. The goal is to structure those relationships with clear data terms, direct platform access for the manufacturer, and export rights that do not depend on the service relationship remaining active. A CRO brings the operational expertise. The manufacturer retains visibility and access. Our piece on choosing a CRO for outsourced clinical activities covers the data governance questions to raise before signing.
The same applies when evaluating any EDC vendor. Data access and export terms deserve the same scrutiny as any other contract term. Our EDC selection guide for medical device investigations covers the questions to ask before signing. Ask what happens to your data access when you stop paying, what format data can be exported in, and whether that export is unconditional or subject to additional fees. Ask whether the manufacturer has direct platform access or whether visibility into the study depends on reports the vendor produces. The answers will tell you more about the working relationship than any marketing language will.
Why this matters more now
The regulatory trajectory in both the US and EU is moving toward continuous evidence generation, not one-time submissions. FDA's increasing interest in real-world evidence, EU MDR's PMCF requirements, and the emergence of performance-based reimbursement in several markets all point in the same direction: clinical evidence is an ongoing program, not a project completed before clearance.
Manufacturers who treat clinical evidence as infrastructure, rather than a milestone, carry structural advantages in that environment. They can respond to post-market requests without first recovering data from prior study partners, have a historical evidence base that supports label expansion without starting over, and can demonstrate to investors that their evidence generation is systematic and auditable.
The manufacturers who find this harder are those who deferred the data access question, where the terms were unclear or assumed rather than established, and where a new regulatory obligation becomes the moment they discover the gap.
Making clinical evidence a strategic asset
Clinical evidence that you can access freely and reuse across multiple regulatory and commercial contexts is a different category of asset than clinical evidence whose availability depends on a service relationship.
Building that asset requires two things. First, clear data rights established before any study starts, in contracts with CROs, sites, laboratories, and EDC vendors. Second, direct platform access for the manufacturer from the start of the study, so that visibility into the data is not contingent on what a partner chooses to share.
Neither of these is technically difficult. They require deliberate decisions early in study planning, when contract terms can still be negotiated and platform selection is still open. They also require recognizing that the two are connected. Clear contractual data rights do not help much if the manufacturer has no direct way to access or export the data independently. Both need to be in place.
Manufacturers who establish both end up with clinical programs that can support a full device lifecycle: pre-market investigation, regulatory submission, label expansion, post-market surveillance, HTA submissions, and investor due diligence, all drawing from the same accessible evidence base. Manufacturers who defer the question often encounter it at the worst possible time, when a regulatory obligation is due and the original study partners are no longer easy to reach.
Keep reading
If you are building out your clinical evidence program, these guides go deeper on the specific components:
- EDC systems for medical device clinical trials: the definitive guide
- How to choose an EDC system for medical device clinical investigations
- Outsourcing clinical activities: choosing a CRO
- Good Clinical Practice (GCP) compliance in clinical data collection
- Data management and reporting in FDA-regulated clinical trials
- The clinical evidence investors actually care about
BONUS RESOURCE:
15-in-1 Clinical Investigations Content Bundle
15-in-1 Clinical Investigations Content Bundle
.png?width=790&name=15-in-1%20clinical%20investigations%20content%20bundle%20(new).png)
.png?width=250&height=323&name=15-in-1%20clinical%20investigations%20content%20bundle%20(new).png)
